FAQ
Simple answers to the things people always want to know before getting started. Can’t find what you’re looking for?
Where do you start?
Three questions. We'll point you to the right service.
1 — How many staff does your business have?
2 — What's your biggest concern right now?
3 — Do you have an IT team?
You might also need
Or just talk to us — Get in touch
Don’t Wait Until It’s Too Late
Most businesses don’t realise they have a security problem until after an incident.
By then, it’s already expensive.
The reality is simple: cyber incidents are no longer a question of if — but when.
Practical Security. No Fluff.
We work with business to deliver real-world, actionable security — not theoretical reports that sit on a shelf.
Our approach is:
Whether you’re starting from scratch or improving existing controls, we meet you where you are.
Know Your Risk in Weeks, Not Months.
You don’t need a massive programme to get started.
A targeted assessment can quickly show:
Most clients walk away with clear priorities within 1–2 weeks.
Do I really need cybersecurity if I’m a small business?
Yes — small and medium businesses are targeted more than most people realise. 43% of all cybercrime in NZ is directed at small and medium businesses, precisely because attackers know they’re less likely to have strong defences. The good news is that the most effective protections for small businesses are also relatively simple and affordable. We can help you prioritise the things that matter most for your situation.
Where do I start? There seem to be a lot of services.
Most businesses start with one of two things: a risk assessment to understand where they stand, or our managed security service if they want ongoing protection handled for them. Not sure which fits? Book a free 30-minute conversation — we’ll tell you honestly what makes sense for your situation, including if the answer is “start with something simpler.”
What happens in the first conversation?
A free 30-minute call — no sales pitch, no obligation. We ask you about your business, your technology, and your current concerns. We’ll give you an honest view of where we think your biggest risks are and what we’d recommend as a first step. If we’re not the right fit for what you need, we’ll tell you that too.
How quickly can you get started?
Usually within a week of agreeing scope, sometimes faster for urgent situations. For urgent matters like an active incident or an impending audit, call us directly and we’ll prioritise accordingly.
Do I need to have IT knowledge to work with KIS?
Not at all. Part of our job is translating technical concepts into language that makes sense for a business owner. We work with plenty of clients who don’t have an IT background — and we’d rather have an honest conversation about what something means than use jargon to seem impressive.
What do I need to provide to get started?
For most engagements: about an hour of your time (for the initial conversation and final debrief), access to the right people in your business, and read-only access to the systems we’re reviewing. We never need admin credentials or the ability to make changes without your explicit approval. That’s genuinely it — no IT team required, no preparation beyond booking the first call.
How does your pricing work?
We offer tiered monthly packages starting from $399/month NZD (exc. GST), as well as one-off engagements for things like penetration testing or risk assessments. Our pricing page has a full breakdown. We’ll always confirm exact pricing before any engagement begins — no surprises.
Is there a minimum contract length?
For ongoing managed services (monitoring, vCISO), we ask for a minimum 3-month commitment so we have time to set things up properly and demonstrate value. After that, contracts roll monthly. One-off engagements like risk assessments and pen tests have no ongoing commitment.
Can you work within a limited budget?
Yes. We’re used to working with businesses that can’t spend enterprise-level amounts on security. Tell us your budget and we’ll tell you honestly what we can achieve within it — and what to prioritise. We’d rather give you the most valuable security for your money than oversell you into something you can’t sustain.
Do you offer any free services?
Yes. Our free Essential 8 assessment is a practical starting point for any NZ business. We also offer a free 30-minute consultation, and we’re happy to answer specific questions over email with no obligation to engage.
What is managed security as a service?
It means KIS handles your cybersecurity on an ongoing basis — monitoring your systems, training your staff, reviewing your vulnerabilities, and responding when something goes wrong. You get enterprise-level protection without needing an in-house security team. Everything is reported to you monthly in plain English. See the full managed security service page for details.
What is a penetration test and do I need one?
A penetration test (pen test) is a controlled, authorised attempt to break into your systems — using the same techniques a real attacker would. It’s different from a vulnerability scan because a pen tester actively tries to chain vulnerabilities together to demonstrate real impact. You likely need one if you handle sensitive customer data, have internet-facing systems, process payments, or if a client or insurer has asked for one.
How long does a risk assessment take?
For a small business, typically 1–2 weeks from start to report delivery. This includes an initial conversation, a review of your systems and current controls, and the production of a plain-English report with prioritised recommendations. We’ll also walk you through the findings in a 60-minute session so you leave with a clear plan.
What’s the difference between a vCISO and a security consultant?
A security consultant typically delivers a specific piece of work — a pen test, a risk assessment, a training session. A virtual CISO (vCISO) is an ongoing strategic role. They own your security programme, advise your board, manage vendor relationships, and ensure your security investment is focused on the right things. Think of the consultant as a specialist, and the vCISO as your head of security on a fractional basis.
What does the NZ Privacy Act 2020 require of my business?
The Privacy Act 2020 applies to any organisation that collects personal information about New Zealanders. Key obligations include: only collecting information you actually need, keeping it secure, being transparent about how you use it, and — crucially — reporting serious privacy breaches to the Privacy Commissioner and the affected individuals. KIS can help you understand your specific obligations and build the processes to meet them.
Do I need ISO 27001?
ISO 27001 is a globally recognised information security management standard. You’re most likely to need it if enterprise customers or government agencies are asking for it as a condition of doing business, or if you’re trying to sell into international markets. It’s not legally required for most NZ businesses, but it can open commercial doors. KIS can help you decide whether it’s the right investment for your stage and goals.
What is the Essential Eight?
The Essential Eight is a set of eight prioritised security controls developed by the Australian Cyber Security Centre (ACSC). They’re increasingly referenced in NZ government and enterprise contexts as a practical baseline for cyber security. The controls include things like patching, application control, multi-factor authentication, and regular backups. KIS can assess your current maturity against the Essential Eight and help you improve it.
What should I do if I think I’ve been hacked?
Call us immediately — don’t wait. The first hours after discovering an incident are the most critical for containing damage and preserving evidence. Even if you’re not a current client, call hello@kis.co.nz or reach us directly. We’ll advise you on immediate steps and, if needed, deploy our incident response team. In the meantime: don’t turn off affected devices (this can destroy evidence), don’t pay any ransom without talking to us first, and document what you’ve observed.
Do I need to report a breach to anyone?
Under the NZ Privacy Act 2020, you must notify the Privacy Commissioner of a privacy breach if it’s likely to cause serious harm to the people whose information was affected. You should also notify the affected individuals directly. Depending on your industry, there may be additional reporting obligations — for example, to the FMA for financial services firms. KIS can guide you through what’s required for your specific situation.
Should I get cyber insurance?
Cyber insurance is worth considering for most NZ businesses, especially those handling sensitive customer data or processing payments. It can cover costs like incident response, legal fees, regulatory fines, and business interruption. However, insurers are tightening requirements — many now require evidence of specific security controls (like MFA and regular backups) before they’ll issue a policy. KIS can help you get your security posture to a level that makes you insurable, and we can advise on what to look for in a policy.
How is managed security different from just having antivirus?
Antivirus is a single tool that catches known malware. Managed security is a complete programme covering your technology, your people, and your processes. Think of it as the difference between a smoke detector and a fire service — one alerts you after the fact, the other actively works to prevent incidents and responds immediately when something happens.
What does 24/7 managed monitoring actually mean?
It means our tooling — backed by our team — is watching your systems around the clock for signs of suspicious activity. When something looks wrong, we investigate and act. You receive a monthly report summarising what was detected, what we did about it, and the state of your environment. You never need to log into a dashboard or interpret a security alert — that’s our job.
Can I start with just one service and add more later?
Absolutely. Many clients start with a one-off risk assessment or M365 review to understand where they stand, then move to a managed service once they’ve seen how we work. There’s no pressure to commit to an ongoing programme upfront.
What is NIST CSF 2.0?
NIST Cybersecurity Framework 2.0 is the most widely referenced security framework globally, updated in 2024 with a new “Govern” function that brings security leadership and board accountability into the picture. We use it as the basis for our risk assessments and it’s increasingly cited in NZ board-level security conversations. It’s a strong choice for any organisation wanting a structured, internationally recognised approach to managing cyber risk.
Does GDPR apply to my NZ business?
GDPR applies to any organisation that processes personal data of EU residents — including NZ businesses with EU customers, EU website visitors, or EU employees. You don’t need a European office for GDPR to apply. Fines can reach €20M or 4% of global turnover. If you have any EU-facing operations, it’s worth understanding your exposure. KIS can assess whether GDPR applies and what you’d need to do to comply.
How do I know which compliance framework my business needs?
It depends on your market, your clients, and your growth stage. KIS covers 17 frameworks across security, privacy, and AI regulation — but most businesses only need one or two to start. Common starting points: NZ Privacy Act 2020 (all NZ businesses), ISO 27001 (selling to enterprise or exporting), SOC 2 (SaaS with US customers), PCI DSS (card payments), EU AI Act (AI systems affecting EU users). We’ll tell you honestly what’s worth pursuing and what isn’t yet.
How do I prepare my business before an incident happens?
The most valuable thing you can do is have an incident response plan before you need it. This is a short, practical document covering who to call, what to do first, what not to do, and how to communicate with staff, customers, and regulators. KIS builds IR plans and runs tabletop exercises where your leadership team walks through a simulated incident — so when the real thing happens, everyone already knows their role.
Does AI governance apply to my business?
Almost certainly yes — if your staff use ChatGPT, Microsoft Copilot, or any AI tool in their work, you have an AI governance question. The risks include data leakage (staff pasting client information into AI tools), privacy breaches under the NZ Privacy Act, and regulatory exposure under the EU AI Act if your business affects EU users. Our AI governance service starts with a simple audit of what’s actually in use.
What is the EU AI Act and does it apply to NZ and AU businesses?
The EU AI Act came into force in August 2024 and applies to any organisation whose AI systems affect EU residents — regardless of where that organisation is based. If your e-commerce store, SaaS platform, or professional services firm has EU customers, you may be in scope. High-risk AI applications (hiring tools, credit scoring, medical systems) face the strictest requirements. KIS can assess your exposure and help you prepare.
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for AI management systems — effectively the ISO 27001 equivalent for AI, published in December 2023. It provides a framework for responsible AI development and use, covering governance, risk management, transparency, and accountability. Enterprise procurement teams and government agencies are starting to request it. It pairs naturally with ISO 27001 for organisations pursuing both.
What’s the NIST AI RMF and why does it matter?
The NIST AI Risk Management Framework is a voluntary but widely adopted US framework for identifying, assessing, and managing AI risks. The 2024 Generative AI profile specifically addresses risks from tools like ChatGPT and Copilot — making it directly relevant to almost any business using modern AI tools. We use it as the assessment basis for our AI governance engagements.